�j7xt���tm����h/Tg}����^��.�zPi~������G�iǮ��EL��O �DqQ�2���,�G,�����|8�'�+�V~Vr�'�=/W�YGr����*����`t���-� :�0��[}s�� ��D�B��~�[�DYA��{Xa�DŞ���,|�*TX��S=(�\�x���,� )�e%�Ȗ�M��Q���V�5]E"��D�%�n`d�|��ݸnek��6�3URN��Q ��̭x&]�U�y��FNf̩�JQykix�OZ+b��乹�F�]R0 (��=�1;�$ut��t�&r��^��w-Ra9�����WM��eBl����U)�� ހ�b�{�;��E���e�}8ypyj��0����#M���#ES�iy��d������Y���H�,C�k�s�3Br�s*k����V�H�95�؈���k/b��%��vۅ��x��Q7|�5�1����$�qkB���?^��G6-(�2�a���(u�+V��کi�&�/1WL�X����4V>1(4T>�i�q��G��a]���ⶹ�C5Ψ����b�a%�OB�:���ֽ�K�W�E��VN�Vc�Z �0�0y�q�:I�6���pFҳ�.L���-�B�|�?3��R'�R�V��6�q������J\bѹ�����$�{��5hw�Rz��I�6H�Y{�����;tv�5 �ae +Jn��L�5iEѕ����d��R�6���2��Q{�$G�38@4���Ο�<$ ԇko�K�7�T3���ٖ��y���G_�CY�VQ�'��e�N1Qk�������K/3st7��H�����A7�1����4��=��R?��s5�Ա�=HL��0�M2���K�B̫��f4�����ؘw�F-K�6�q���ޘ�!���mB�<�}U����}�����af#_�O���h���f�-�K�����qۮJ��k��N Щ�yhq�A�2sψ4��t��C�.��0���:Qq�3x��B9g�)��թb�w6B�if<Hfeg��^ƪ��q1�s��_�ô�]~�Sj0��/7���2� !fT>!R&xp3�s��k��վp���~���'mp�W1��6Ue��X�T�&H�� R��$uC�>����W�ŰU!훼Ѧ$�R?.��J�sZ�Or�歉"z9��8������#>�6���XJ��J8�wX�!c `�#�F�Uƈ�MP��Ra� �<B׃X������Nŏ�We/�6���IQ��I��bB��ύ�ݽ��}f�n��bm C�+Pۻ��E����Z���b��t�fL����M�L�i?L��(��.#�,�W/�|�Y �,�l%LA�bRc��qG�{u���{܆��(ɲ��}�ϕ8��lw͂Z��[�mA���͗��_3�f c�}��*⬃��m���Z���Sн�sM�N��£v�<z�{.�����xlS*8���A�9�s�u�!G2�����μJ�|���⾎����O��� ��|M�;�fRe������/\+�ȇ�x$�I��7X�-? Dp�ű�\����.��~3R�X�����r}TEBeb��L�����\�s��r��n�?&~ ``lC��"E���3�e��C_4����N���d�5T-��^a���p�<suK7վ�V���h щqtU����[�3�֑���i7�ǞO�ٝP�en�,A�����"'���Α���F{�>�7e�P,g�N���a���z7w6��m���8fL�'��6q�8�*�l��~��Ls��*t߱\ז����Bܶ��}�Rp���r"���`��:ˌW,�����K��K���Rf��V��8:[���������S˜��^h�۪3��v(L ���] >����'BWx�%;�����콓�N��%�$��@�o���� ���7�F� Bqb�9c�:��$�7W��[;QdzԷEڬl�%T�ܡ����yI S�6QJ�U&����+���j�:&kW��C�W����t����sĪXSx�������̔<�k�����,�y}�It:k,�<��p'�_�� ��\Ox���Y���9���4}yd���!ԙ3�#����R�)t���n������jH���"ʹBF�����e�?�P�`�._���E���=��(��'����&�J���ZөR��Ti��}ܵg8�M�Vu+��66�� Qc�@�>��_ �;a��r[@�K�F�Bp�:�}O�"��iE~=�����e��,�:&�Zm�Pc?�J�+N8}#�����+PԃwhW��f�:�?���q� |���D�u��Tw!�Gl`Pw���o��Rէ�������z��K~)��?l�����H[m�t�0�@�3�}�Ũ�v��<��R�>.�@^����Z�bL)*�5��WABt ushv���]�������7�*{K��Xe�"K�f"Ϊ�#�T��ۛ�du�5�M���JU�j;����������q)���.Ls��3bM���f�(��9�����,n�`����!a*�����i�-�R��2�i�8�-h��YAraR��H��W��:��-��]�-W�D�P` 5���:k���-��TJغzc!]�����S갃�b`}1�"����'�̃����GJ�Z��k�&��r�EB�Tm�,'�p�E'�̆��z��1���(z�������a�w��p�n�_ݜ�P��eU��?�D��k� ���z&yN������\����FLP!g��N�K���D'l�n$Σb��#�ؔ;wğ��A.yf�7�����r6������^������$�F�||)�������VĚ������ɹ3�s7��s!��/�d N��w��@ �Z�ku$�q�G)�&�-F�n���ഩT�2hޗQ�>[me+/9}k��PA�Tt.�Mckz�,�>����+L�%�� ����f�3|���:iB���>_��>#�(�f{/��UzV}MM���)^�e����I�/I>,���tr��_��/=�cYX�֛����Q�1��c����t��f��k5.�p�������H���;/.Md~����5���=/�:D��cl �O�9Ũ ��̂��U��3�� p ȶ2�%�Fv4]<D�����k3~�G+3J�gћ�F��p,�כ/���0�w������j��w��u� 23�lfb���Ӏ�����4��`��5�:���xh���~����R+�4~�#��5�eU-\)`[���6k��G�������4��l�IϜ�V��G�6�O��;�|���6�2R�)0ZN��;�ۻq5�6�~e�����[s�����pͫ i���[����ֶF�e�A,g�%l�i�k ��`D3�w�ev5?��d+B��a���A�~�x��������.�����2�Ij��=�x��6H�jn�]��ԅ��pd �e[
Overview
overview
10Static
static
7Loaders/EA...er.exe
windows10-1703-x64
5Loaders/EA...er.exe
windows10-2004-x64
7Loaders/FN Chair.exe
windows10-1703-x64
10Loaders/FN Chair.exe
windows10-2004-x64
9Cleaners/a...er.exe
windows10-1703-x64
9Cleaners/a...er.exe
windows10-2004-x64
9Cleaners/a...ed.exe
windows10-1703-x64
9Cleaners/a...ed.exe
windows10-2004-x64
9Cleaners/c..._1.exe
windows10-1703-x64
9Cleaners/c..._1.exe
windows10-2004-x64
9Cleaners/c..._2.exe
windows10-1703-x64
7Cleaners/c..._2.exe
windows10-2004-x64
7Loaders/Gh...II.exe
windows10-1703-x64
9Loaders/Gh...II.exe
windows10-2004-x64
9Loaders/Khemical.exe
windows10-1703-x64
9Loaders/Khemical.exe
windows10-2004-x64
9Loaders/Mu...er.exe
windows10-1703-x64
9Loaders/Mu...er.exe
windows10-2004-x64
9Loaders/WZ...V1.exe
windows10-1703-x64
5Loaders/WZ...V1.exe
windows10-2004-x64
5Loaders/WZ...V2.exe
windows10-1703-x64
5Loaders/WZ...V2.exe
windows10-2004-x64
5Loaders/WZ...er.exe
windows10-1703-x64
9Loaders/WZ...er.exe
windows10-2004-x64
9Loaders/WZ...ir.exe
windows10-1703-x64
9Loaders/WZ...ir.exe
windows10-2004-x64
9Behavioral task
behavioral1
Sample
Loaders/EAC BE Spwoofer.exe
Resource
win10-20231020-en
Behavioral task
behavioral2
Sample
Loaders/EAC BE Spwoofer.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral3
Sample
Loaders/FN Chair.exe
Resource
win10-20231020-en
Behavioral task
behavioral4
Sample
Loaders/FN Chair.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral5
Sample
Cleaners/applecleaner.exe
Resource
win10-20231020-en
Behavioral task
behavioral6
Sample
Cleaners/applecleaner.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral7
Sample
Cleaners/applecleaner_updated.exe
Resource
win10-20231023-en
Behavioral task
behavioral8
Sample
Cleaners/applecleaner_updated.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral9
Sample
Cleaners/cleaner_1.exe
Resource
win10-20231020-en
Behavioral task
behavioral10
Sample
Cleaners/cleaner_1.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral11
Sample
Cleaners/cleaner_fixed_2.exe
Resource
win10-20231025-en
Behavioral task
behavioral12
Sample
Cleaners/cleaner_fixed_2.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral13
Sample
Loaders/GhostWare_MWIII.exe
Resource
win10-20231023-en
Behavioral task
behavioral14
Sample
Loaders/GhostWare_MWIII.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral15
Sample
Loaders/Khemical.exe
Resource
win10-20231020-en
Behavioral task
behavioral16
Sample
Loaders/Khemical.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral17
Sample
Loaders/Multi Spwoofer.exe
Resource
win10-20231020-en
Behavioral task
behavioral18
Sample
Loaders/Multi Spwoofer.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral19
Sample
Loaders/WZ2 AIO V1.exe
Resource
win10-20231020-en
Behavioral task
behavioral20
Sample
Loaders/WZ2 AIO V1.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral21
Sample
Loaders/WZ2 AIO V2.exe
Resource
win10-20231025-en
Behavioral task
behavioral22
Sample
Loaders/WZ2 AIO V2.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral23
Sample
Loaders/WZ2 UA Spwoofer.exe
Resource
win10-20231020-en
Behavioral task
behavioral24
Sample
Loaders/WZ2 UA Spwoofer.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral25
Sample
Loaders/WZ2 VIP Chair.exe
Resource
win10-20231023-en
General
-
Target
Loaders.zip
-
Size
122.1MB
-
MD5
9036f38db3169ee39ac25a963d9970f2
-
SHA1
c673d087d61a5e564fc839eb7d8772502e1328b4
-
SHA256
0a857b39e37388680b4b0633af3c155af71cd7ea8a6de6877b9f8468f9f4daf1
-
SHA512
b665f217e257c68f3f370ed15a4903570c22d0df30e181ef50c0963decc46367ff265f70307681ec397c48655a7dbc4183884ebfc7e2a6ae3f639bd1bfcbd7ff
-
SSDEEP
3145728:A8D4XBz4HBT8Qbjoh6nvH0HojQiW2UyaeL5dHEf4NHg0e:A8c+HB1johxIsN2Uya8/Ha4NHxe
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Loaders/FN Chair.exe themida static1/unpack002/Cleaners/applecleaner.exe themida static1/unpack002/Cleaners/applecleaner_updated.exe themida static1/unpack002/Cleaners/cleaner_1.exe themida static1/unpack001/Loaders/GhostWare_MWIII.exe themida static1/unpack001/Loaders/Multi Spwoofer.exe themida static1/unpack001/Loaders/WZ2 UA Spwoofer.exe themida static1/unpack001/Loaders/WZ2 VIP Chair.exe themida -
resource yara_rule static1/unpack002/Cleaners/cleaner_fixed_2.exe vmprotect -
Unsigned PE 13 IoCs
Checks for missing Authenticode signature.
resource unpack001/Loaders/EAC BE Spwoofer.exe unpack001/Loaders/FN Chair.exe unpack002/Cleaners/applecleaner.exe unpack002/Cleaners/applecleaner_updated.exe unpack002/Cleaners/cleaner_1.exe unpack002/Cleaners/cleaner_fixed_2.exe unpack001/Loaders/GhostWare_MWIII.exe unpack001/Loaders/Khemical.exe unpack001/Loaders/Multi Spwoofer.exe unpack001/Loaders/WZ2 AIO V1.exe unpack001/Loaders/WZ2 AIO V2.exe unpack001/Loaders/WZ2 UA Spwoofer.exe unpack001/Loaders/WZ2 VIP Chair.exe
Files
-
Loaders.zip.zip
-
Loaders/EAC BE Spwoofer.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 6.6MB - Virtual size: 7.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 112KB - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 285KB - Virtual size: 8.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Loaders/FN Chair.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 3.8MB - Virtual size: 8.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 1.5MB - Virtual size: 3.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 8.9MB - Virtual size: 9.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 160KB - Virtual size: 277KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 315KB - Virtual size: 315KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 752B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 7KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 48.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 29.2MB - Virtual size: 29.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 16B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
-
Loaders/FN Cleaners.rar.rar
-
Cleaners/applecleaner.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 54KB - Virtual size: 142KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 12KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 49KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 300B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 49KB - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 3.2MB - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 16B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
-
Cleaners/applecleaner_updated.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 54KB - Virtual size: 142KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 12KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 49KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 300B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 49KB - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 3.2MB - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 16B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
-
Cleaners/cleaner_1.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 28KB - Virtual size: 69KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 5KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 238B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 274B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 146B - Virtual size: 156B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.imports Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 3.3MB - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
-
Cleaners/cleaner_fixed_2.exe.exe windows:6 windows x64 arch:x64
f73b888923e673a768df4bffb6e90a20
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
IsDebuggerPresent
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
RegCloseKey
ole32
CoTaskMemFree
msvcp140
??Bid@locale@std@@QEAA_KXZ
iphlpapi
GetAdaptersInfo
vcruntime140
__current_exception
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_seh_filter_exe
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-stdio-l1-1-0
_fseeki64
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-string-l1-1-0
toupper
api-ms-win-crt-multibyte-l1-1-0
_mbscmp
api-ms-win-crt-math-l1-1-0
ceilf
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
�:�[#y:m`f�m�@e�v�o����Y2��$�6����w�������ϸ�no�(�+]��v�y���;ʬ� ����<�aq w�j{�R�o��B3��,�1f�[�!|�7D��yr��m���ד6�+f�)s���k���KP�?�Tc�6%L����y���n�<������T ��.�qn:c�ۈ��#Ӄ�u�fl�pX�v���N�S���y�<��P�qI��,����j&>P�1'|¨j��6FÂl�CC_��^�l�Of�g��fK+�������s�~���,ߩ�HD���{�ZX�T{TU����S�"Xߦ��T���*�B��F����I(z(q�Z�9�4��1��;e�8GM��LԀ�Z�������� I@�P#�AaQű��i�����!���ܱr����d�� ��Y�9�Fk�C��ЊF�����c|������*-ȵZs�Q�t�9�ҩ�-�vL�*��zX���!���k����Edg��� �(D�����Pq B^�j�8��!� �s{d�����u��q�5A��&XS�ܰsl�%�����0����봻�x�AU1�����A>>�>�$��>=�\1�(�!�ޒ�%��1�4C����ޤD̉���ԑ���A���L,��+)+�;���u"��e+�]*���Z��y�����)8~���,�a<����K+�CdD��s4R�"�q=r�A%�%^�����씥̨@\��yZ:�\��v.�B�̩���H\�9�ȭ���;|*�������0dN�e�7pM�D�Z<=~��ZL�/����3&���ٷ{K�ywq��݇��c3�f����(Ս��Tbn�B-���FȆ�P����!���|�il�� ��*��I��_���X���!�9c(K%N�� !���{�ˇ>� %�t�qj���4��5 a��q�Tc�+(c'�������Ew�4fx��y2D�^bG3�J��!jV��쪌�!wo. T���<�Xշ��O��I��В�a��(�:���u��hq'mx�N�8�j�����ws*�>ؐ;H��|x��m�k ���f��C�ME;+z�. �a<�B�oX�cE`�U��2�r,�Ng��=nf@�~�\λ��L~���5)���0X����ﶗ�y@8�W6��Ą��k�Qפ�]E�8=���q$���C�uΟ(-���:�����ѹ�4���R0����3���`Ѥ�#@7�D+cFR��)~~R"�\��B+e���`f� (.��Y!$Τ����Gd��I��`1�tҸس�C;Ƕ�\ޘ�[q��h�U�/9��l��p��fR���)T8N��O��v����xLJ]7e�Yn��2�'����r���&k}ȹ��x��)���b�5~p]����9>�GY�S�ߑØ�I#�f����!=�����+�E��~��IN��/*��H��6������`;�����];�s&3�î{2���`�=.���,�z>M��؞����\��CxOp��<�t(,�tp2&C<iI/r�{\��ߨf�Þ����e2� vXZDG���!�I7Ñ55�ؘ�땐7=��k�:bj��Q�d�7���X�ߑQ*����-�Z���P��� ����ko;�'����$�t%.�n�m�;Aj����w�g�Kp㎵ئO�Qh$�r��ފ.�w������DC�s��-2wz�%��cBD���Dm�4��eN<�����[c!�^"������G��z��Q�2.���[[5^�G*���/3)~ҧb�ܙ����@�6�|Ϳ�ez��f*p���5�m���Wi�*�GܮυC��a�zԸ�6�;�T�BV�����iih��d^�<����kfx�g��C>�)4�����" �^8<���`�]�-Ƭ���/��y���=���l62i�L��A��{u��nG�,���_2�)�<�{"�]�Μ3��y�6�A�*�1�w�+|��ʊv�5�KT�0B&�D�����$��P�mFay�����z�b|թ��4�Q87����$�s�p���%��R�l�w$�PD9 /{}��%�٠�d����>��;���� ��-�+{ü�7s."L�4|�>�e�N5�A\#�Lپ����|�K+?�H���%�b��z=^ذr?���Lm�a�%ʷ*�8�z'���coքb��y8�Xs���#7�˓��7��,�]���41~YV��C����S~�����A :^��QP�~2Q tv�S�/�5��D:�w��:�3p���uq��R�!�,n������A��Rf!c�ϧ^i3n'\�wG�3W&���z��b٘���;�*���PH �E��Jf �M�3m�rEm yY�]�Dŝ�� �+��k,C�'/�'2o<��،�Ɔ刻y��ZRm?).v��*Fg��������4�m��������+4zghE'�L.i&6��������YP0s���c� ��6t-�R���I���_�w���|�>k�� ���i.��46�(<�b�[��g�`f�$�,�#D��ꋔ�q�T���`�v�K�Y��_�pC�f��1���:磟axzY���j2b�'k�������A�,~�Q��l���5a }-�\�Z'rK�G�]��y6Q��wW��m�5�_��u=!OT�w���i��EL��I7\G�(-�К�� \����c��:Rv�I^m3����kwg��pV0�^d�L8��J�H�F)�D��$,Ơ'�ְ2�k,��J@6�BrV}�H�8&��)��"���{eG�7��O��G�2�i�rI*�I)R�M;�NI?��먋vȫ��ە5�}`���W��}��sRD@����є�� Ө@Z@&[���ӕ�� ~p�8��7��c�̾a��ZZ�/_uD�8&�qY ��D�4S8>��!�д�Q������B_&�t>�#\�����*/���ft��U��C^:K_U�2A/3�#D�<W�������Po|!hwY�GVE��nW�� ���P�A����JdǚB]��d)=�q��(��Wqѩ��*�����̾�ӡ��@��z��Cd��3�p¬�{�O�w��
Sections
.text Size: - Virtual size: 178KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 964KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.1MB - Virtual size: 6.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 192B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 476B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
How to clean Guide.txt
-
Loaders/GhostWare_MWIII.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 406KB - Virtual size: 993KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 65KB - Virtual size: 182KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 2KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 31KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 432B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 5.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 3.4MB - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 16B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
-
Loaders/Khemical.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
??0Assembler@asmjit@@QEAA@PEAURuntime@1@@Z
??0CodeGen@asmjit@@QEAA@PEAURuntime@1@@Z
??0HostRuntime@asmjit@@QEAA@XZ
??0JitRuntime@asmjit@@QEAA@XZ
??0Runtime@asmjit@@QEAA@XZ
??0StaticRuntime@asmjit@@QEAA@PEAX_K@Z
??0VMemMgr@asmjit@@QEAA@PEAX@Z
??0X86Assembler@asmjit@@QEAA@PEAURuntime@1@I@Z
??0Zone@asmjit@@QEAA@_K@Z
??1Assembler@asmjit@@UEAA@XZ
??1CodeGen@asmjit@@UEAA@XZ
??1HostRuntime@asmjit@@UEAA@XZ
??1JitRuntime@asmjit@@UEAA@XZ
??1Runtime@asmjit@@UEAA@XZ
??1StaticRuntime@asmjit@@UEAA@XZ
??1VMemMgr@asmjit@@QEAA@XZ
??1X86Assembler@asmjit@@UEAA@XZ
??1Zone@asmjit@@QEAA@XZ
??_FVMemMgr@asmjit@@QEAAXXZ
?_alloc@Zone@asmjit@@QEAAPEAX_K@Z
?_emit@X86Assembler@asmjit@@UEAAIIAEBUOperand@2@000@Z
?_grow@Assembler@asmjit@@QEAAI_K@Z
?_grow@PodVectorBase@asmjit@@IEAAI_K0@Z
?_newLabel@Assembler@asmjit@@QEAAIPEAULabel@2@@Z
?_newLabelLink@Assembler@asmjit@@QEAAPEAULabelLink@2@XZ
?_nullData@PodVectorBase@asmjit@@2UPodVectorData@2@B
?_registerIndexedLabels@Assembler@asmjit@@QEAAI_K@Z
?_relocCode@X86Assembler@asmjit@@UEBA_KPEAX_K@Z
?_reserve@Assembler@asmjit@@QEAAI_K@Z
?_reserve@PodVectorBase@asmjit@@IEAAI_K0@Z
?_x86CondToCmovcc@asmjit@@3QBIB
?_x86CondToJcc@asmjit@@3QBIB
?_x86CondToSetcc@asmjit@@3QBIB
?_x86InstExtendedInfo@asmjit@@3QBUX86InstExtendedInfo@1@B
?_x86InstInfo@asmjit@@3QBUX86InstInfo@1@B
?_x86ReverseCond@asmjit@@3QBIB
?add@JitRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z
?add@StaticRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z
?align@X86Assembler@asmjit@@UEAAIII@Z
?alloc@VMemMgr@asmjit@@QEAAPEAX_KI@Z
?alloc@VMemUtil@asmjit@@SAPEAX_KPEA_KI@Z
?allocProcessMemory@VMemUtil@asmjit@@SAPEAXPEAX_KPEA_KI@Z
?allocZeroed@Zone@asmjit@@QEAAPEAX_K@Z
?bind@Assembler@asmjit@@UEAAIAEBULabel@2@@Z
?callCpuId@X86CpuUtil@asmjit@@SAXIIPEATX86CpuId@2@@Z
?detect@X86CpuUtil@asmjit@@SAXPEAUX86CpuInfo@2@@Z
?detectHwThreadsCount@CpuInfo@asmjit@@SAIXZ
?dup@Zone@asmjit@@QEAAPEAXPEBX_K@Z
?embed@Assembler@asmjit@@UEAAIPEBXI@Z
?embedLabel@X86Assembler@asmjit@@QEAAIAEBULabel@2@@Z
?emit@Assembler@asmjit@@QEAAII@Z
?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00@Z
?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00H@Z
?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00_K@Z
?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0@Z
?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0H@Z
?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0_K@Z
?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@@Z
?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@H@Z
?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@_K@Z
?emit@Assembler@asmjit@@QEAAIIH@Z
?emit@Assembler@asmjit@@QEAAII_K@Z
?flush@HostRuntime@asmjit@@UEAAXPEAX_K@Z
?getCpuInfo@HostRuntime@asmjit@@UEAAPEBUCpuInfo@2@XZ
?getHost@CpuInfo@asmjit@@SAPEBU12@XZ
?getPageGranularity@VMemUtil@asmjit@@SA_KXZ
?getPageSize@VMemUtil@asmjit@@SA_KXZ
?getStackAlignment@HostRuntime@asmjit@@UEAAIXZ
?make@Assembler@asmjit@@UEAAPEAXXZ
?noOperand@asmjit@@3UOperand@1@B
?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KAEBUX86Reg@2@IHI@Z
?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KHI@Z
?release@JitRuntime@asmjit@@UEAAIPEAX@Z
?release@StaticRuntime@asmjit@@UEAAIPEAX@Z
?release@VMemMgr@asmjit@@QEAAIPEAX@Z
?release@VMemUtil@asmjit@@SAIPEAX_K@Z
?releaseProcessMemory@VMemUtil@asmjit@@SAIPEAX0_K@Z
?relocCode@Assembler@asmjit@@QEBA_KPEAX_K@Z
?reset@Assembler@asmjit@@QEAAX_N@Z
?reset@PodVectorBase@asmjit@@QEAAX_N@Z
?reset@VMemMgr@asmjit@@QEAAXXZ
?reset@Zone@asmjit@@QEAAX_N@Z
?sdup@Zone@asmjit@@QEAAPEADPEBD@Z
?setArch@X86Assembler@asmjit@@QEAAII@Z
?setError@CodeGen@asmjit@@QEAAIIPEBD@Z
?setErrorHandler@CodeGen@asmjit@@QEAAIPEAUErrorHandler@2@@Z
?sformat@Zone@asmjit@@QEAAPEADPEBDZZ
?shrink@VMemMgr@asmjit@@QEAAIPEAX_K@Z
?x86RegData@asmjit@@3UX86RegData@1@B
Sections
Size: 1.6MB - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 373KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 10KB - Virtual size: 81KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 88KB - Virtual size: 155KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 7.6MB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 13KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.edata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 9.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 7.4MB - Virtual size: 7.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 16B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
-
Loaders/Multi Spwoofer.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 390KB - Virtual size: 968KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 62KB - Virtual size: 176KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 2KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 30KB - Virtual size: 55KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.voltbl Size: 512B - Virtual size: 12B
Size: 512B - Virtual size: 432B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 6.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 3.6MB - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 16B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
-
Loaders/WZ2 AIO V1.exe.exe windows:6 windows x64 arch:x64
6aeff77412842f08afd35b9bf970bdbf
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
CreateRemoteThread
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowThreadProcessId
advapi32
CryptAcquireContextA
shell32
ShellExecuteA
msvcp140
??0_Lockit@std@@QEAA@H@Z
ntdll
RtlGetVersion
normaliz
IdnToAscii
wldap32
ord32
crypt32
CertFreeCertificateContext
ws2_32
bind
rpcrt4
UuidCreate
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
api-ms-win-crt-string-l1-1-0
_stricmp
api-ms-win-crt-runtime-l1-1-0
exit
api-ms-win-crt-stdio-l1-1-0
fsetpos
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-filesystem-l1-1-0
_fstat64
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-multibyte-l1-1-0
_mbsicmp
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
__setusermatherr
Sections
.text Size: - Virtual size: 470KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 131KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 280KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.fkoff0 Size: - Virtual size: 8.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.fkoff1 Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.fkoff2 Size: 14.6MB - Virtual size: 14.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 272B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Loaders/WZ2 AIO V2.exe.exe windows:6 windows x64 arch:x64
75c89ab2e67808c191f68f4f4f9d52ca
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetProcAddress
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
PostThreadMessageA
CharUpperBuffW
advapi32
CryptGetHashParam
shell32
ShellExecuteA
ntdll
RtlVirtualUnwind
wininet
InternetCloseHandle
ws2_32
send
normaliz
IdnToAscii
wldap32
ord211
crypt32
CertFindCertificateInStore
Exports
Exports
��RgI���hNb�������/�G&��7N��z� ����W�� U+�/fC��IeyF8Bٕ���˕e�H<H{31M?�L+���\�d���#F=�'��cȾ���Gl���ȿ[�J:KܬTαR��g}�x� � ����ܭ���������bZ$�m��q�| >�c�K�nǵ]�������[���&��� t�o|琟0��)� �st�|H24�>����c�A3��0sP7��(y�ݮ���LP �#������+D;>).�vU2�~���C�%ztV@�m���,��״s�D�y�8��+XѾ��k�|:��b�ɶtP\m����z'O1�\�C����Z��U$�?��̀ET��erI�n�W�=]�� *�8k_�Q$x��Ϯ�?߱6�m1���3��;�.~?� ��(V�ވ�����A���/Ɗ���؋�c��/�g ���k�r���/��:���+����`����l�(���!���U���=��lC��|��;��"��y������)��X��I�" Hu!N4h�#���+ܪ���k��G$[ |�e%�\}i>#�_|��'��9*���c�w����j��N��H�o��i��4QM��GO/�,��� ��Ap�ʿ�z�r"���3 &��}l�-d�q�?&_�JO ����Vwo�����;e#Y�F��Xkon�" ����j�����n�g^�Jw4j�ښL��`^1_r��*����F|���E<Yzx�[��t0E�0�S_�g�t"g�!\��%>�`j2�jOX��2P��;�S?�'���Oѷ��z����+ g#Ʀ�±����w����}����IᯁbǼj��8�[u��Kߟܜs��.�hR%��@�{���M����J7�t����K��x$����f �nQWy���e�+�kpE5w�ɏ��m���n�\e�7y��qE�8z�G_1�I�M1��k��6���ǝ�*w�;����*�"�6%�г�ψ�gF,Џ�~�)U���[A�+?�?Bi����:o�k.oX�zb�o��m"�A4�s��6cWS��D����PX��g��0�RN�V`���)r�x�T�(�xϋ�a��'�1d���0���0 � f�����|0��qw�8�n�c,2�v�����=3�n�#Z<6��0�\��z��юKd�>'�������0����gP�pTFXd�5�S��m�|�P���rΥ�T��K'��4�g;�(��F�r J�2�q[�fo<ځ�7k%��EmWX"��+�-n3O�]]��C��s���8��ˑ���t��!¨�U���o�J� `c?�>�9E�|K_����%����~��[��Te�;� �ߙ�pe�Ի��2%�]$ߴ�u�;��Q?��jVc��{҅O��i=�� O~��8�S�W��%Ӣv�m�\�����瀇��������鹂������dǍ���ŷص)7���x./ٌV⦨��%5I���DN���0<Ź�������?���4�.|��G���� smʘ��@Mrʝ��tT�����B�`X�������$��q!�ݓ��V�B�6�c��q����;�iVI�������^��;�]5�;>��}�'�p M�*����t]�'�e����dB��P� �&��=chtC� @=jQ-�� �I���D��� MHx�zH-��:���(]����F�&�96.��Z��o��ԍ$(��:���~�L�:j�*o�ӕ��R�'Mç��Պ�'�z���(l����P{���(�'5��j�g����E]�[A.3#�Gd����:6o�& ����M�E�.�$��3J����ط<'��\�jl��V�%{0�>��?�-�o�33a�5]�O/���0PU��1�x��������85R�S|�Tovj��@#Z2�k������d���0H�K9��L��'��C��q��(7&��+.�"�(W�R�A��!:{�>k�u�z�[S(?��Nc�Ui(���eB�cIa�����P�Y��z��1t�9�Sg�����]��*Nb���bt������U;��E�hm��a���Q�~��`���!$�KF��h����従��R�����/�YΜ�7���GH%���K"S�ݍ��W_��JI��p���kD A�����W�f�U0� %���HB�u��,�~O������j�3�ݴ�)��'�xٖ���������B�e'Q�����y��aib��,�X� %�L,�F6IH�q�v�k���@�����MA�3�r����7��%������'|��o-�d�|&��|"$���'�Q!�����ݖg/`��@�s�����k>C1�̤��@�}�.9�.�� h�����c:sO/��e\8ކ �5������� >�/bk�$SzU�1�FG���a{�M��ԳT|�r���u�!��4;�� 5�H4�t3���ӊ�p��fK�a�24�y�j��Ps��$Y���P[Pl=/x��DH���|�"7���X���i�C��*p[uz�2�[����h�Rτ 3��C�L�C����n��ϪjIh����Wd����L����6+�����A�~U6�@w.�ysza}CA�w�hTjMkj ��y-��kW�)F�1�ÐH x��� 4�:f�5^�W�bN�?��SA[�l&��q�����u7J�Ո�8�'����݂�����C���w8Z����-����\u��*�ڏO�����z���Έ윑2j�i!=!ZTT>�\�[ݥs�v�G�v����2[<;�ܑ܃dO��X��.!{U�l9װ�spo�2��>��f� N��ٝ�\eA�f"��OR=��(z 61c�v���e�=��F�����Ch��Ͱ��pTՄ����q4�_�`��Џ�M��X��ÍܕF�QQ�<�Lb6x��x����a�$D�zK���_3hTUc�?��(H�r��D�<�B>y�x�WZ./-�H� ��!?�)s�<�s�i�?�j�{���*Sd�ywL��,w3l\�c����&$�F��Ƙs��gj�̎���l
Sections
.text Size: - Virtual size: 585KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 288KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.oT: Size: - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.hx[ Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.V_P Size: 6.1MB - Virtual size: 6.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Loaders/WZ2 UA Spwoofer.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 390KB - Virtual size: 968KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 62KB - Virtual size: 176KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 2KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 30KB - Virtual size: 55KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.voltbl Size: 512B - Virtual size: 12B
Size: 512B - Virtual size: 432B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 5.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 3.4MB - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 16B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
-
Loaders/WZ2 VIP Chair.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 390KB - Virtual size: 968KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 62KB - Virtual size: 176KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 2KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 30KB - Virtual size: 55KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.voltbl Size: 512B - Virtual size: 12B
Size: 512B - Virtual size: 432B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 5.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 3.3MB - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 16B - Virtual size: 4KB
IMAGE_SCN_MEM_READ